[jira] [Updated] (GROOVY-12374) Launchers: match java classpath semantics — no implicit . when -cp is set

["Paul King (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/GROOVY-12374?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Paul King updated GROOVY-12374:
-------------------------------
    Description: 
h2. Problem

The launcher scripts ({{startGroovy}} / {{startGroovy.bat}}) always append the current directory ({{.}}) to the classpath, in every branch -- including when an explicit {{-cp}}/{{-classpath}} option or the {{CLASSPATH}} environment variable is supplied:

{code:bash}
if [ -n "$CP" ] ; then
    CP="$CP":.
elif [ -n "$CLASSPATH" ] ; then
    CP="$CLASSPATH":.
else
    CP=.
fi
{code}

This has two problems:

* It diverges from the {{java}} interpreter, which does *not* add {{.}} when a classpath is given ({{java -cp foo Main}} uses only {{foo}}). It also contradicts the launcher's own comment, which claims {{-cp}} behaves "the same as the java interpreter".
* It places the current working directory on the classpath of *every* Groovy command, so running a tool from a directory containing a stray {{.class}} can load it -- an untrusted-search-path footgun (CWE-427).

h2. Change

An explicit {{-cp}}/{{-classpath}} option, or the {{CLASSPATH}} environment variable, is now honoured as-is. Only a bare invocation with no classpath given falls back to the current directory, matching {{java}}/{{javac}}.

Applied uniformly across both launchers ({{startGroovy}} and {{startGroovy.bat}}), and therefore to {{groovy}}, {{groovyc}}, {{groovysh}}, {{groovyConsole}}, and the rest.

h2. Compatibility

* The common "cd into a project and run" workflow is *unchanged*: a bare {{groovy MyScript.groovy}} still puts the current directory on the classpath, so sibling scripts, classes and resources resolve as before.
* The only behaviour change: {{groovy -cp lib.jar MyScript}} no longer silently adds {{.}} as well. Anyone relying on that must include it explicitly -- {{-cp lib.jar:.}} (Unix) or {{-cp lib.jar;.}} (Windows) -- exactly as {{java}} has always required.

Being a behaviour change to the launchers, this is targeted at 6.0. Documented in the command-line tools user guide.


> Launchers: match java classpath semantics — no implicit . when -cp is set
> -------------------------------------------------------------------------
>
>                 Key: GROOVY-12374
>                 URL: https://issues.apache.org/jira/browse/GROOVY-12374
>             Project: Groovy
>          Issue Type: Improvement
>            Reporter: Paul King
>            Priority: Major
>
> h2. Problem
> The launcher scripts ({{startGroovy}} / {{startGroovy.bat}}) always append the current directory ({{.}}) to the classpath, in every branch -- including when an explicit {{-cp}}/{{-classpath}} option or the {{CLASSPATH}} environment variable is supplied:
> {code:bash}
> if [ -n "$CP" ] ; then
>     CP="$CP":.
> elif [ -n "$CLASSPATH" ] ; then
>     CP="$CLASSPATH":.
> else
>     CP=.
> fi
> {code}
> This has two problems:
> * It diverges from the {{java}} interpreter, which does *not* add {{.}} when a classpath is given ({{java -cp foo Main}} uses only {{foo}}). It also contradicts the launcher's own comment, which claims {{-cp}} behaves "the same as the java interpreter".
> * It places the current working directory on the classpath of *every* Groovy command, so running a tool from a directory containing a stray {{.class}} can load it -- an untrusted-search-path footgun (CWE-427).
> h2. Change
> An explicit {{-cp}}/{{-classpath}} option, or the {{CLASSPATH}} environment variable, is now honoured as-is. Only a bare invocation with no classpath given falls back to the current directory, matching {{java}}/{{javac}}.
> Applied uniformly across both launchers ({{startGroovy}} and {{startGroovy.bat}}), and therefore to {{groovy}}, {{groovyc}}, {{groovysh}}, {{groovyConsole}}, and the rest.
> h2. Compatibility
> * The common "cd into a project and run" workflow is *unchanged*: a bare {{groovy MyScript.groovy}} still puts the current directory on the classpath, so sibling scripts, classes and resources resolve as before.
> * The only behaviour change: {{groovy -cp lib.jar MyScript}} no longer silently adds {{.}} as well. Anyone relying on that must include it explicitly -- {{-cp lib.jar:.}} (Unix) or {{-cp lib.jar;.}} (Windows) -- exactly as {{java}} has always required.
> Being a behaviour change to the launchers, this is targeted at 6.0. Documented in the command-line tools user guide.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)